Extracted

• • Target

    JaffaCakes118_9ff9e0283dcadd5b0776529825da327d833e7ebe118ac5306703316f7a3e0626

  • Size

    233KB

  • MD5

    526f3f70f2ce2f84f3ab1c115e86117b

  • SHA1

    2320ba17d9412c954c553bcaec33cf30ca2d826c

  • SHA256

    9ff9e0283dcadd5b0776529825da327d833e7ebe118ac5306703316f7a3e0626

  • SHA512

    b15b716679301c3e109a8d1e06ae95c4c170633ff1ecf9dfdd78a930003b73059a36be2ea7b2732089278b7318ccec2110c971a3173863b123407525e3256c06

  • SSDEEP

    6144:7BbOZy8Skh3L+3v/1WhR4o5vfjjlmXR8K:7BbOZy8fa3v/IySNsa

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2